Microsoft AZ-500 Practice Test 99
Question 980
A cloud security team sees partial GCP resource discovery because required service account permissions were omitted. A review identifies this consequence: Connecting one GCP project does not automatically grant access to every other project. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to assume a single public DNS entry enables security posture access to all GCP projects.
- The controlled remediation is to use an Azure subscription Owner account as a substitute for Google Cloud IAM.
- The controlled remediation is to repair supported project scope and validate which GCP assets appear.
- The controlled remediation is to disable provider audit logging to simplify GCP connector errors.
Explanation
Correct Answer
C:Test using these records: GCP project inventory, connector state, authorization audit and Defender assessment coverage. External cloud visibility depends on correctly configured provider-side identities and connectors.
Incorrect Answers
A:Assume a single public DNS entry enables security posture access to all GCP projects. This would not reliably restore the intended security boundary. Connecting one GCP project does not automatically grant access to every other project. The appropriate controlled recovery is: Repair supported project scope and validate which GCP assets appear.
B:Use an Azure subscription Owner account as a substitute for Google Cloud IAM. This would not reliably restore the intended security boundary. Connecting one GCP project does not automatically grant access to every other project. The appropriate controlled recovery is: Repair supported project scope and validate which GCP assets appear.
D:Disable provider audit logging to simplify GCP connector errors. This would not reliably restore the intended security boundary. Connecting one GCP project does not automatically grant access to every other project. The appropriate controlled recovery is: Repair supported project scope and validate which GCP assets appear.
Question 981
A hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections. Which operator action best meets this technical requirement?
- Treat a ping to the datacenter server as proof of Defender for Servers onboarding.
- Onboard the supported machine through Azure Arc and connect the appropriate Defender plan.
- Install an unrelated browser extension instead of the required machine connector.
- Disable Arc extensions to make missing security alerts disappear.
Explanation
Correct Answer
B:Confirm the change against these records: Arc connected machine state, subscriptions, extension health and Defender recommendations. Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
Incorrect Answers
A:A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring.
C:Install an unrelated browser extension instead of the required machine connector. The proposed change targets the wrong mechanism or lacks essential validation. Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Relevant evidence is arc connected machine state, subscriptions, extension health and Defender recommendations.
D:A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The intended action is: Onboard the supported machine through Azure Arc and connect the appropriate Defender plan.
Question 982
A hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections. Which collection of observations most directly tests the suspected cause?
- Arc connected machine state, subscriptions, extension health and Defender recommendations.
- A connected agent indicator without a matching data collection rule or event record.
- An incident title without its actual source telemetry and detection results.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
Explanation
Correct Answer
A:These records test the actual Azure Arc security onboarding behavior rather than an unrelated dashboard state. Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Arc connected machine state, subscriptions, extension health and Defender recommendations.
C:On its own, that evidence does not prove the specified security control works. Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
D:On its own, that evidence does not prove the specified security control works. In the given case, a hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections.
Question 983
A hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections. Which statement most accurately explains this scenario?
- Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
- Turning off an alert source is equivalent to remediating the underlying threat.
- Assigning a policy automatically remediates all existing resources under every effect.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
Explanation
Correct Answer
A:This principle supports the security response: Onboard the supported machine through Azure Arc and connect the appropriate Defender plan. Confirmation depends on Arc connected machine state, subscriptions, extension health and Defender recommendations.
Incorrect Answers
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Arc security onboarding. The relevant security behavior is: Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Check evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure Arc security onboarding. The relevant security behavior is: Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Check evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
D:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure Arc security onboarding. The relevant security behavior is: Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Check evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
Question 984
A hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections. Suppose the operator instead follows this unsafe shortcut: Treat a ping to the datacenter server as proof of Defender for Servers onboarding. What is the principal technical consequence of the mistaken choice?
- A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring.
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- A successful remediation test was the original reason the plan was disabled.
Explanation
Correct Answer
A:The suitable control is: Onboard the supported machine through Azure Arc and connect the appropriate Defender plan. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Azure Arc security onboarding weakness after the shortcut. The material failure is: A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring.
C:This does not explain the real Azure Arc security onboarding weakness after the shortcut. Inspect evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
D:This does not explain the real Azure Arc security onboarding weakness after the shortcut. In the given case, a hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections.
Question 985
A hybrid Windows server is visible in an on-premises inventory but missing from relevant Defender for Cloud protections. A review identifies this consequence: A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. Which recovery action restores the intended control and validates its effect?
- Install an unrelated browser extension instead of the required machine connector.
- Disable Arc extensions to make missing security alerts disappear.
- Treat a ping to the datacenter server as proof of Defender for Servers onboarding.
- Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
Explanation
Correct Answer
D:This addresses the observed security problem while providing a verifiable outcome. Test using these records: Arc connected machine state, subscriptions, extension health and Defender recommendations.
Incorrect Answers
A:Install an unrelated browser extension instead of the required machine connector. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
B:Disable Arc extensions to make missing security alerts disappear. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
C:That option would treat a ping to the datacenter server as proof of Defender for Servers onboarding, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 986
A non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association. What is the most defensible Azure security action?
- For this Azure workload, the team should onboard the supported machine through Azure Arc and connect the appropriate Defender plan.
- For this Azure workload, the team should install an unrelated browser extension instead of the required machine connector.
- For this Azure workload, the team should disable Arc extensions to make missing security alerts disappear.
- For this Azure workload, the team should treat a ping to the datacenter server as proof of Defender for Servers onboarding.
Explanation
Correct Answer
A:Confirm the change against these records: Arc connected machine state, subscriptions, extension health and Defender recommendations. In the given case, a non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association.
Incorrect Answers
B:Install an unrelated browser extension instead of the required machine connector. The proposed change targets the wrong mechanism or lacks essential validation. Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Relevant evidence is arc connected machine state, subscriptions, extension health and Defender recommendations.
C:A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring.
D:A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. Treat a ping to the datacenter server as proof of Defender for Servers onboarding.
Question 987
A non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association. Which diagnostic record would most strongly confirm the result?
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine arc connected machine state, subscriptions, extension health and Defender recommendations.
- In this security review, examine an incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
C:These records test the actual Azure Arc security onboarding behavior rather than an unrelated dashboard state. The intended action is: Onboard the supported machine through Azure Arc and connect the appropriate Defender plan.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association.
B:The more relevant observations are: Arc connected machine state, subscriptions, extension health and Defender recommendations.
D:Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
Question 988
A non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
C:This principle supports the security response: Onboard the supported machine through Azure Arc and connect the appropriate Defender plan.
Incorrect Answers
A:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure Arc security onboarding. The relevant security behavior is: Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Check evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Arc security onboarding. The relevant security behavior is: Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Check evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure Arc security onboarding. The relevant security behavior is: Azure Arc extends supported Azure management and security integrations to hybrid and external servers. Check evidence such as arc connected machine state, subscriptions, extension health and Defender recommendations.
Question 989
A non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association. Suppose the operator instead follows this unsafe shortcut: Treat a ping to the datacenter server as proof of Defender for Servers onboarding. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that a server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
Explanation
Correct Answer
B:The suitable control is: Onboard the supported machine through Azure Arc and connect the appropriate Defender plan. Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
Incorrect Answers
A:This does not explain the real Azure Arc security onboarding weakness after the shortcut. In the given case, a non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association.
C:This does not explain the real Azure Arc security onboarding weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
D:This does not explain the real Azure Arc security onboarding weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
Question 990
A non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association. A review identifies this consequence: A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to repair Arc connection and Defender coverage and verify current hybrid machine assessments.
- The controlled remediation is to disable Arc extensions to make missing security alerts disappear.
- The controlled remediation is to treat a ping to the datacenter server as proof of Defender for Servers onboarding.
- The controlled remediation is to install an unrelated browser extension instead of the required machine connector.
Explanation
Correct Answer
A:This addresses the observed security problem while providing a verifiable outcome. Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
Incorrect Answers
B:Disable Arc extensions to make missing security alerts disappear. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
C:Treat a ping to the datacenter server as proof of Defender for Servers onboarding. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
D:Install an unrelated browser extension instead of the required machine connector. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
